Inside the Shadows – Exposing Russia’s FSB Spy Network

For over a year, a team of open-source intelligence (OSINT) researchers delved deep into the enigmatic network that is Russia’s FSB 16th Center, the successor to the Soviet KGB’s signals intelligence (SIGINT) apparatus.

This shadowy organization, officially known as the Center for Radio-Electronic Intelligence Utilizing Communication (Unit 71330), is believed to coordinate much of Russia’s communications interception, cryptanalysis, and offensive cyber operations worldwide.

A meticulous analysis of over 200 publicly available photographs of military insignia symbols, founding dates, internal codes, and even maps granted unprecedented insight into this reclusive entity.

Through “phaleristics,” the study of medals and badges, researchers confirmed that the 16th Center inherited advanced capabilities from the Soviet KGB and FAPSI (Federal Agency for Government Communications and Information), reorganized under the FSB in 2003.

Analysis of a Modern Spy Empire

The FSB 16th Center is not a monolith but a web of at least ten distinct departments, each identified by cryptic letters (A, B, V, D, K, P, S, SP, ST, and T). 

The mission profiles vary, including cryptanalysis, cyber operations, and technical support, but are rarely revealed.

Insignia analysis uncovered evidence of internal subunits; for instance, “Department T” even boasts its own “No. 9” branch, while two field sections (“Section 3” and “Section 7”) suggest regionalized coverage.

Staffing estimates, derived from Russian conventions that define “department” and “section” by personnel size, indicate the Center employs at least 560 operatives.

These technical experts and field officers collectively manage a sprawling eavesdropping infrastructure spanning the nation and beyond.

The SIGINT Network: Listening Posts Across Russia

Researchers geolocated ten active FSB SIGINT facilities, known as “Special Communications Centers” (TsSS), each tied to a unique military code.

These listening posts strategically scattered from Sochi’s Adler district to Kaliningrad employ a mix of advanced radomes, parabolic antennas, multibeam tracking dishes (MBTAs), and massive circularly disposed dipole arrays (CDAAs, or Wullenwebers). 

Designed for intercepting both satellite (SATCOM) and terrestrial signals, these stations can capture and geolocate foreign military, diplomatic, and commercial transmissions thousands of kilometers away.

Some key sites include:

• Unit 03110, Adler (Sochi region): The newest post, equipped with multiple protected radomes targeting signals from the Caucasus and Middle East.
• Unit 11380, Temryuk (near Crimea): Features a 15-meter MBTA and a gigantic CDAA capable of omnidirectional interception.
• Unit 70822, Khabarovsk: Near the Chinese border, this center’s 160-meter CDAA covers signals from Northeast Asia, including China, the Koreas, and Japan.

The Real-World Impact

While encryption has challenged interception efforts, the FSB’s deep roots in cryptanalysis imply that encrypted streams, especially diplomatic and military traffic, remain top targets.

Open-source techniques, leveraging phaleristics and geolocation, have effectively illuminated Russia’s most clandestine SIGINT operations and revealed a robust organization primed for global intelligence collection.